pkgsrc

cvsweb: http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/

Through CVS.

pkgsrc supports two branches: pkgsrc-current, which has the latest packages and uses a freeze period for extensive review (but is possible to review continuously) pkgsrc-stable, which is a release branch.

Quarterly releases are made. The current release is 2016Q1. It is not properly a "release", because security and significant bug fixes can be done, but stability must be preserved.

Releases are CVS branches. For example, it may be used with cvs ... -r2016Q1.

It contains a doc/CHANGES-YEAR file. the latest, viewed from cvsweb, is the following: http://cvsweb.netbsd.org/bsdweb.cgi/~checkout~/pkgsrc/doc/CHANGES-2016?rev=1.1833&content-type=text/plain

Rather than offer a singular list which must be viewed by a human, it offers extensive tools for checking for vulnerabilities. Upon install, the user can opt to disallow packages known to be vulnerable (ALLOW_VULNERABLE_PACKAGES=yes), or audit already installed packages using convenient tools: https://www.netbsd.org/docs/pkgsrc/using.html#vulnerabilities

mailing lists: pkgsrc-bugs: https://mail-index.netbsd.org/pkgsrc-bugs/index.html issue tracker: http://www.netbsd.org/support/send-pr.html

You may search the issue tracker here: http://www.netbsd.org/support/query-pr.html

While no link for statistics exist, it is uncommon for a bug report to be unacknowledged.

You may search the issue tracker here: http://www.netbsd.org/support/query-pr.html Or the mailing lists of said issue tracker: http://mail-index.netbsd.org/pkgsrc-bugs/index.html

It suggests contacting the pkgsrc-security team in the pkgsrc guide: http://www.netbsd.org/docs/pkgsrc/fixes.html#security-handling

Contacting pkgsrc-security is strongly recommended, and emails to this list are not public by default: http://www.netbsd.org/docs/pkgsrc/fixes.html#security-handling

pkgsrc carries a bootstrap tool: cd pkgsrc/bootstrap && ./bootstrap it will build all the required tools from source code.

It uses mostly BSD makefiles. It contains any tools required for building packages.

pkglint is the common tool for testing an individual package and is BSD-2 licensed, it is also a package hosted within pkgsrc. mass build tests can be done using bulkbuild, a BSD licensed package also hosted within pkgsrc.

typical invocation of pkglint: pkglint -Wall -Call.

raw bulk build test reports, on a mailing list archive: http://mail-index.netbsd.org/pkgsrc-bulk/2016/04/thread1.html

Bulk build reports are publicly viewable on a mailing list archive: http://mail-index.netbsd.org/pkgsrc-bulk/2016/04/thread1.html

pkglint is used, and checks new packages for problems. it is a BSD-2 licensed project hosted within pkgsrc.

It has the pkgsrc-security team with several such members.

SHA-3

SHA-3 is used.

pkgsrc itself uses a SHA3 sum for online source code downloads.

No passwords.

CVS is done over SSH. source code downloads are checked against SHA3 sums, as the downloads are typically done from the original source, not a rehosted repository of source code, and not all packages use HTTPS, and even if they did, they could not be trusted to not have a security problem and change the source code for a package.

pkgsrc tools have no known vulnerabilities (they are extremely minimal). packages with vulnerabilities are patched when possible.

pkgsrc infrastructure has no known vulnerabilities. some packages do and do not contain any fixes - when they do, they are updated.

Private credentials are not used.

It is a package manager using primarily makefiles, so only the pkgsrc tool pkglint can be reasonably used.

Downloaded external files are checked against a SHA3 sum, but no further checks are possible.

pkglint should not be capable of discovering vulnerabilities except for MITM attacks (by a mismatched signature for downloaded files), which are tested at every use.

Contributors are strongly encouraged to use pkglint

most of pkgsrc is the makefiles, which aren't normally tested for such things.

Typically no dynamic code analysis is done. however, any reports will be answered.